Skip to content

Commit bbf69e8

Browse files
EmyrkEmyrk
committed
chore: audit entries for all idp sync changes
1 parent 02fd758 commit bbf69e8

File tree

14 files changed

+208
-41
lines changed

14 files changed

+208
-41
lines changed

‎coderd/audit/diff.go

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ package audit
22

33
import (
44
"github.com/coder/coder/v2/coderd/database"
5+
"github.com/coder/coder/v2/coderd/idpsync"
56
)
67

78
// Auditable is mostly a marker interface. It contains a definitive list of all
@@ -26,7 +27,10 @@ type Auditable interface {
2627
database.CustomRole |
2728
database.AuditableOrganizationMember |
2829
database.Organization |
29-
database.NotificationTemplate
30+
database.NotificationTemplate |
31+
idpsync.OrganizationSyncSettings |
32+
idpsync.GroupSyncSettings |
33+
idpsync.RoleSyncSettings
3034
}
3135

3236
// Map is a map of changed fields in an audited resource. It maps field names to

‎coderd/audit/request.go

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ import (
2020
"github.com/coder/coder/v2/coderd/database"
2121
"github.com/coder/coder/v2/coderd/database/dbtime"
2222
"github.com/coder/coder/v2/coderd/httpmw"
23+
"github.com/coder/coder/v2/coderd/idpsync"
2324
"github.com/coder/coder/v2/coderd/tracing"
2425
)
2526

@@ -121,11 +122,22 @@ func ResourceTarget[T Auditable](tgt T) string {
121122
return typed.Name
122123
case database.NotificationTemplate:
123124
return typed.Name
125+
case idpsync.OrganizationSyncSettings:
126+
return "Organization Sync"
127+
case idpsync.GroupSyncSettings:
128+
return "Organization Group Sync"
129+
case idpsync.RoleSyncSettings:
130+
return "Organization Role Sync"
124131
default:
125132
panic(fmt.Sprintf("unknown resource %T for ResourceTarget", tgt))
126133
}
127134
}
128135

136+
// noID can be used for resources that do not have an uuid.
137+
// An example is singleton configuration resources.
138+
// 51A51C = "Static"
139+
var noID, _ = uuid.Parse("51A51C00-0000-0000-0000-000000000000")
140+
129141
func ResourceID[T Auditable](tgt T) uuid.UUID {
130142
switch typed := any(tgt).(type) {
131143
case database.Template:
@@ -169,6 +181,12 @@ func ResourceID[T Auditable](tgt T) uuid.UUID {
169181
return typed.ID
170182
case database.NotificationTemplate:
171183
return typed.ID
184+
case idpsync.OrganizationSyncSettings:
185+
return noID // Deployment all uses the same org sync settings
186+
case idpsync.GroupSyncSettings:
187+
return noID // Org field on audit log has org id
188+
case idpsync.RoleSyncSettings:
189+
return noID // Org field on audit log has org id
172190
default:
173191
panic(fmt.Sprintf("unknown resource %T for ResourceID", tgt))
174192
}
@@ -214,6 +232,12 @@ func ResourceType[T Auditable](tgt T) database.ResourceType {
214232
return database.ResourceTypeOrganization
215233
case database.NotificationTemplate:
216234
return database.ResourceTypeNotificationTemplate
235+
case idpsync.OrganizationSyncSettings:
236+
return database.ResourceTypeIdpSyncSettingsOrganization
237+
case idpsync.RoleSyncSettings:
238+
return database.ResourceTypeIdpSyncSettingsRole
239+
case idpsync.GroupSyncSettings:
240+
return database.ResourceTypeIdpSyncSettingsGroup
217241
default:
218242
panic(fmt.Sprintf("unknown resource %T for ResourceType", typed))
219243
}
@@ -261,6 +285,12 @@ func ResourceRequiresOrgID[T Auditable]() bool {
261285
return true
262286
case database.NotificationTemplate:
263287
return false
288+
case idpsync.OrganizationSyncSettings:
289+
return false
290+
case idpsync.GroupSyncSettings:
291+
return true
292+
case idpsync.RoleSyncSettings:
293+
return true
264294
default:
265295
panic(fmt.Sprintf("unknown resource %T for ResourceRequiresOrgID", tgt))
266296
}

‎coderd/database/dump.sql

Lines changed: 4 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/database/migrations/000279_idpsync_settings.down.sql

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
-- Nothing to do

‎coderd/database/migrations/000279_idpsync_settings.up.sql

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
-- Allow modifications to notification templates to be audited.
2+
ALTER TYPE resource_type ADD VALUE IF NOT EXISTS 'idp_sync_settings_organization';
3+
ALTER TYPE resource_type ADD VALUE IF NOT EXISTS 'idp_sync_settings_group';
4+
ALTER TYPE resource_type ADD VALUE IF NOT EXISTS 'idp_sync_settings_role';

‎coderd/database/models.go

Lines changed: 29 additions & 20 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/idpsync/organization.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -149,13 +149,13 @@ type OrganizationSyncSettings struct {
149149
// Field selects the claim field to be used as the created user's
150150
// organizations. If the field is the empty string, then no organization updates
151151
// will ever come from the OIDC provider.
152-
Field string
152+
Field string `json:"field"`
153153
// Mapping controls how organizations returned by the OIDC provider get mapped
154-
Mapping map[string][]uuid.UUID
154+
Mapping map[string][]uuid.UUID `json:"mapping"`
155155
// AssignDefault will ensure all users that authenticate will be
156156
// placed into the default organization. This is mostly a hack to support
157157
// legacy deployments.
158-
AssignDefault bool
158+
AssignDefault bool `json:"assign_default"`
159159
}
160160

161161
func (s *OrganizationSyncSettings) Set(v string) error {

‎codersdk/audit.go

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -30,10 +30,13 @@ const (
3030
ResourceTypeOrganization ResourceType = "organization"
3131
ResourceTypeOAuth2ProviderApp ResourceType = "oauth2_provider_app"
3232
// nolint:gosec // This is not a secret.
33-
ResourceTypeOAuth2ProviderAppSecret ResourceType = "oauth2_provider_app_secret"
34-
ResourceTypeCustomRole ResourceType = "custom_role"
35-
ResourceTypeOrganizationMember = "organization_member"
36-
ResourceTypeNotificationTemplate = "notification_template"
33+
ResourceTypeOAuth2ProviderAppSecret ResourceType = "oauth2_provider_app_secret"
34+
ResourceTypeCustomRole ResourceType = "custom_role"
35+
ResourceTypeOrganizationMember ResourceType = "organization_member"
36+
ResourceTypeNotificationTemplate ResourceType = "notification_template"
37+
ResourceTypeIdpSyncSettingsOrganization ResourceType = "idp_sync_settings_organization"
38+
ResourceTypeIdpSyncSettingsGroup ResourceType = "idp_sync_settings_group"
39+
ResourceTypeIdpSyncSettingsRole ResourceType = "idp_sync_settings_role"
3740
)
3841

3942
func (r ResourceType) FriendlyString() string {
@@ -78,6 +81,12 @@ func (r ResourceType) FriendlyString() string {
7881
return "organization member"
7982
case ResourceTypeNotificationTemplate:
8083
return "notification template"
84+
case ResourceTypeIdpSyncSettingsOrganization:
85+
return "settings"
86+
case ResourceTypeIdpSyncSettingsGroup:
87+
return "settings"
88+
case ResourceTypeIdpSyncSettingsRole:
89+
return "settings"
8190
default:
8291
return "unknown"
8392
}

‎enterprise/audit/diff.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ import (
44
"database/sql"
55
"fmt"
66
"reflect"
7+
"strings"
78

89
"github.com/google/uuid"
910
"golang.org/x/xerrors"
@@ -49,6 +50,7 @@ func diffValues(left, right any, table Table) audit.Map {
4950
)
5051

5152
diffName := field.FieldType.Tag.Get("json")
53+
diffName = strings.TrimSuffix(diffName, ",omitempty")
5254

5355
atype, ok := diffKey[diffName]
5456
if !ok {

‎enterprise/audit/table.go

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,10 @@ import (
55
"os"
66
"reflect"
77
"runtime"
8+
"strings"
89

910
"github.com/coder/coder/v2/coderd/database"
11+
"github.com/coder/coder/v2/coderd/idpsync"
1012
"github.com/coder/coder/v2/codersdk"
1113
)
1214

@@ -286,6 +288,23 @@ var auditableResourcesTypes = map[any]map[string]Action{
286288
"method": ActionTrack,
287289
"kind": ActionTrack,
288290
},
291+
&idpsync.OrganizationSyncSettings{}: {
292+
"field": ActionTrack,
293+
"mapping": ActionTrack,
294+
"assign_default": ActionTrack,
295+
},
296+
&idpsync.GroupSyncSettings{}: {
297+
"field": ActionTrack,
298+
"mapping": ActionTrack,
299+
"regex_filter": ActionTrack,
300+
"auto_create_missing_groups": ActionTrack,
301+
// Configured in env vars
302+
"legacy_group_name_mapping": ActionIgnore,
303+
},
304+
&idpsync.RoleSyncSettings{}: {
305+
"field": ActionTrack,
306+
"mapping": ActionTrack,
307+
},
289308
}
290309

291310
// auditMap converts a map of struct pointers to a map of struct names as
@@ -335,6 +354,7 @@ func entry(v any, f map[string]Action) (string, map[string]Action) {
335354
// This field is explicitly ignored.
336355
continue
337356
}
357+
jsonTag = strings.TrimSuffix(jsonTag, ",omitempty")
338358
if _, ok := fcpy[jsonTag]; !ok {
339359
_, _ = fmt.Fprintf(os.Stderr, "ERROR: Audit table entry missing action for field %q in type %q\nPlease update the auditable resource types in: %s\n", d.FieldType.Name, name, self())
340360
//nolint:revive

0 commit comments

Comments
 (0)